Ghost Push is a family of

malware Malware (a portmanteau of ''malicious software'')Tahir, R. (2018)A study on malware and malware detection techniques . ''International Journal of Education and Management Engineering'', ''8''(2), 20. is any software intentionally designed to caus ...

that infects the

Android OS Android is an operating system based on a modified version of the Linux kernel and other open-source software, designed primarily for touchscreen-based mobile devices such as smartphones and tablets. Android has historically been developed b ...

by automatically gaining

root access In computing, the superuser is a special user account used for system administration. Depending on the operating system (OS), the actual name of this account might be root, administrator, admin or supervisor. In some cases, the actual name of the ...

, downloading malicious and unwanted software. The malware appears to have been discovered in September 2015 by the security research lab at

Cheetah Mobile Cheetah Mobile Inc. () is a Chinese mobile internet company incorporated in the Cayman Islands and headquartered in Beijing. History Chen Rui ( 陈睿 current CEO of Bilibili) founded Cheetah Mobile. The company was established in 2010 as a me ...

, who subsequently developed diagnostic software to determine whether a device has been compromised. As of September 2015, twenty variants were in circulation. Latter day versions employed routines which made them harder to detect and remove. The malware hogs all the system resources, making the phone slow, draining the battery and consuming cellular data. Advertisements continually appear either as full or partial screen ads or in the status bar. The applications installed by the malware appear to be difficult to remove, impervious to anti-virus software and even surviving a factory reset of the device. Infection typically comes via downloading applications from third-party

app store An app store, also called an app marketplace or app catalog, is a type of digital distribution platform for computer software called applications, often in a mobile context. Apps provide a specific set of functions which, by definition, do not i ...

s, where at least thirty-nine applications have been identified as carriers. At its peak, the Ghost Push virus infected more than 600,000 devices daily, with 50% of infections occurring from India, as well as from Indonesia and the Philippines, ranking second and third. The malware was discovered in September 2015 by

's security research lab.

References

{{reflist Android (operating system) malware